secret management

in English: secrets management

advancedwidespread

Secret management is the secure storage, issuance, rotation, and revocation of passwords, API keys, encryption keys (including private keys for certificates), and other digital access credentials so that only authorized parties can access them.

In plain terms

Both programs and AI agents operate with 'keys': passwords, API keys, or tokens to access email, databases, or banking systems. The industry calls these secrets. Secret management refers to the system that dictates where these keys are stored, who can access them, for how long, and how to rotate them quickly.

It is like a hotel reception. The keys are not under the doormat but in a locked cabinet at the reception. The receptionist only gives a key to someone who is identified, only to the room they are entitled to, and records who took it and when. If a key is lost, the lock is rekeyed.

In the age of AI agents, this has become particularly important. An agent works independently, interacts with many systems, and can be misled by text instructions. If a key is included in the instructions or the conversation text, it could leak. A good solution is one where the agent often does not see the secret itself. Either an intermediary system inserts the key into its requests, or the agent is granted access only briefly for a single task.

How it works

Secrets go into a central, encrypted store (a vault), not into the program code, a spreadsheet or a chat message.
When a program or agent requests access, the system first identifies it, then decides based on rules what it is entitled to, granting only the minimum necessary.
Issued keys should preferably be short-lived: valid for minutes or hours, then expiring automatically, so even if stolen, they are of little value.
Long-term secrets are regularly rotated, and revoked immediately if leakage is suspected.
Every access is logged, so it can be determined afterward who or what used which secret and when.

An everyday example

You entrust an AI agent to organize your inbox and calendar. If well-built, it will not ask for your password; instead, you approve limited, revocable access in an authorization window. Your password remains with you throughout.

Who is affected

developerYou must ensure that keys do not end up in the code, logs, or agent instructions, as they can easily leak from there. → Code

entrepreneur, executiveA single leaked key can cause data loss, downtime, or unexpected bills, so secret management is a business risk, not just an IT issue.

employeeIf you paste a password or key into a chatbot or agent, it may fall outside your company's control. → Work & HR

everyoneThe security of your data also depends on how well the services you use protect their own keys.

A common misconception

MythIf passwords are stored in an encrypted location, secret management is handled.

In realityStorage is only the first step. Equally important is who gets access for how long, how often keys are rotated, and whether it is visible afterward who used what.

Limits and risks

The secret management system itself is a target. Whoever controls the central vault or obtains its administrative access also gains access to many other systems. This is why it must be protected the most.
It does not protect against a case where an authorized agent is deceived and causes damage using its legitimately obtained access.
Old, forgotten keys (in code repositories, backups, or old messages) remain valid even after you introduce a new system. These must be specifically located and revoked.
Discipline is also a human issue: the best tools cannot help if someone sends a password via email for convenience.

Similar, but not the same

password manager – Password managers primarily store people's own login credentials. Secret management automatically handles machine keys for programs and agents in large volumes. Some password managers now offer add-ons for managing machine secrets.
encryption – Encryption makes data unreadable, while secret management safeguards the keys and passwords that unlock the data or system.
access control – Access control decides who has rights to what. Secret management takes care of storing, issuing, and rotating the keys that prove this, while also enforcing the authorization rules.

Related concepts

Broader

cybersecurity, information security, access control

Narrower

API key, key rotation, short-lived credential, secrets leak monitoring

On the edge

principle of least privilege, zero trust, agent identity, prompt injection, sandbox

A brief history

The protection of secrets is as old as computer passwords, but it became an independent field with the cloud and automated software operations, when programs began connecting to each other en masse with keys. One of the field's defining tools, HashiCorp Vault, was released in 2015.

Where things stand

In late 2026, this is a basic requirement in software development, and the major cloud providers offer a built-in solution. For AI agents, however, best practice is still taking shape: short-lived, task-bound access and giving agents their own identities are only now spreading.

Status: 2026 November

Also known as

secret management · secrets management · secrets management · secret management · titokmenedzsment · credential management · credential management · secrets manager

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.